Information processing apparatuses such as servers, Personal Computer (PCs) or various terminals can accumulate log data such as traces outputted from monitoring targets such as (firmware of) devices or applications, as files (log files) in storage apparatuses. A log file accumulated in a storage apparatus is used by a manager or an operator (collectively referred to as a manager below) of an information processing apparatus to investigate (identify) a failure cause when, for example, a failure occurs in the information processing apparatus (monitoring target).
In addition, techniques of extracting one or more logs matching conditions, from one or more log files are known as related techniques (see, for example, Patent Documents 1 to 3 and 5 listed below). Further, a technique of extracting log data related to a failure indicated by a received trigger among log data stored in a ring buffer, and recording the extracted log data in an auxiliary storage apparatus is also known (see, for example, Patent Document 4 listed below).
Patent Document 1: Japanese Laid-open Patent Publication No. 2004-227360
Patent Document 2: Japanese Laid-open Patent Publication No. 2008-140248
Patent Document 3: Japanese Laid-open Patent Publication No. 2010-182194
Patent Document 4: Japanese Laid-open Patent Publication No. 2013-206147
Patent Document 5: Japanese Laid-open Patent Publication No. 2008-158634
Log data (one or more log items; log item group) included in a log file is useful to investigate a failure cause. In addition, a log item is one unit of a log used to investigate a failure cause. The log data used to investigate a failure cause preferably includes log data outputted from a monitoring target in which a failure has occurred, and log data outputted from monitoring targets other than the monitoring target in which the failure has occurred. This allows a manager to easily and accurately investigate (identify) a cause instead of referring to single log data outputted from the monitoring target in which the failure has occurred.
However, a size of a log file and the number of files increase as the time passes, and tightens a storage capacity of a storage apparatus tight. Therefore, an information processing apparatus has difficulty in accumulating all past log files. Hence, for example, as illustrated in FIG. 20, an information processing apparatus deletes (overwrites) old log files in the storage apparatus after a certain period of time passes or after log files of a certain capacity are accumulated. In addition, FIG. 20 illustrates an example where, among log files accumulated in order of log files A, B, C and D in a storage apparatus, the log file A is overwritten by the log file C in (2) and the log file B is overwritten by the log file D in (3).
Hence, the information processing apparatus preferably accumulates (outputs) log data which has been outputted from a monitoring target in which a failure has occurred and relates to the failure without deleting the log data while the capacity of the storage apparatus is limited.
By the way, when a failure occurs in the information processing apparatus, a manager does not necessarily investigate a failure cause immediately after the failure occurs, and investigates the failure cause after the time passes from the occurrence of the failure. In this case, even when the manager tries to investigate the failure cause, log date related to the failure has already been deleted from the information processing apparatus, and therefore it is difficult to investigate the failure cause.
In an example of FIG. 20, the log files are cyclically overwritten in order of (1), (2) and (3). Therefore, when the shaded log file B includes log data related to a failure, the log file B is overwritten by the log file D at the timing of (3).
To prevent log data related to a failure from being lost, for example, the above related technique may be used to cause the information processing apparatus to extract log data related to a failure, from a log file, and store the extracted data in the storage apparatus. However, in the following illustrative cases, it is difficult to cause the information processing apparatus to extract and store (output) appropriate log data.                A character string (e.g. “error” or “warning”) which the information processing apparatus recognizes as a failure is not included in log data related to a failure.        Log data which is not outputted upon a normal time is outputted, and a determination material which allows the information processing apparatus to recognize the log data as a failure is not provided.        Log data which is outputted upon a normal time is defective.        
Further, when the character string such as “error” or “warning” is included in log data which is not related to the failure, log data is normal yet the information processing apparatus determines that the log data as log data related to the failure in some cases.